Communication networks are widely used today: the variety of networks includes the Internet, wide-area networks (WANs), local-area networks (LANs), telephony networks, and wireless networks. The importance of network monitoring and testing is growing as well as the requirements for the related methods and equipment. Monitoring devices may be implemented within the network for monitoring communication along such network. Such monitoring devices are referred to as “eavesdropping devices” or “passive probes” because they are generally not a party to the communication but are instead monitoring such communication for some reason, such as for performance monitoring of the network, testing, and/or other reasons. The elements that constitute the network may also act as eavesdropping devices because they may take traffic traveling through the device and replicate it on another egress port for use by monitoring or testing devices, as it is done in Switched Port Analyzers (SPAN).
Conventional devices for analyzing traffic packets are attached directly to a monitor port or passive network tap at a switch or element, i.e. the test device needs to be present locally, in proximity to the tested network, which may be undesirable.
A Remote Switched Port Analyzer (RSPAN) is an alternative to a directly connected SPAN or monitor ports. A RSPAN port transport packets across a dedicated connection such as a Virtual Local Area Network (VLAN) link to another location. However, transporting of the packets across a network affects the timing of the packet arrival at the packet analyzing device; in particular, a VLAN link introduces jitter and may cause loss of packets. Additionally, the time when a packet was replicated by a RSPAN port is unknown to the receiving device. It is also impossible for the receiving device to determine if the stream received from the remote egress port has experienced packet loss or timing variances such as jitter and reordering. This has an adverse impact an the accuracy and capability of the receiving device.
Furthermore, conventional simple probes do not allow for filtering of the data down to more targeted packets, and the RSPAN approach provides the bulk of captured traffic without any filtering.
Accordingly, there is a need to mitigate the above disadvantages and to provide a novel method and a system for remote monitoring of traffic packets in a network.